T08 · Insecure Dependencies
- Location
SKILL.md:274- Finding
Unpinned Third-Party Python Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 274 and 288
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: MediumComplete Vulnerable Code Snippets
From
SKILL.md, line 274:text Dependency: `pip install Pillow`.From
SKILL.md, line 288:text Dependency: `pip install python-pptx`.The same dependency guidance also appears in:
reference/image-processing.py, line 4reference/ppt-extract.py, line 4
Technical Analysis
The skill directs the agent to install
Pillowandpython-pptxwithout pinning reviewed versions, verifying package hashes, or constraining the package index. Python package installation can execute package-controlled build and installation logic. Consequently, the code executed by these workflows may differ over time from the code originally audited.This creates a supply-chain risk if a dependency release or package repository is compromised, if the environment is configured to use an untrusted package index, or if dependency resolution selects a vulnerable transitive package.
No evidence indicates that the currently named packages are malicious. The vulnerability is the unsafe installation procedure rather than a confirmed malicious package.
Attack Path
- A user requests image processing or PowerPoint conversion.
- The agent follows the dependency instructions in
SKILL.md. - The agent runs
pip install Pilloworpip install python-pptx. - Package resolution retrieves an unpinned release and its transitive dependencies from the configured index.
- A compromised package, dependency, index, or unsafe resolver configuration supplies attacker-controlled installation or runtime code.
- That code executes with the privileges of the user or agent environment during installation or subsequent import.
Impact Assessment
Successful exploitation could execute arbitrary code with the privileges of the process running the install ...[truncated 427 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin each direct dependency to a reviewed version rather than installing the latest available release.
- Generate a lock file containing all resolved transitive dependencies.
- Require cryptographic hashes for every package, for example through a hashed requirements file and
pip install --require-hashes. - Explicitly use a trusted package index and disable unintended extra indexes that could enable dependency confusion.
- Install dependencies in a dedicated, least-privileged virtual environment.
- Obtain explicit user approval before installing packages or changing the environment.
- Scan pinned dependencies for known vulnerabilities and review updates before changing versions.
- Replace the current instructions with a hardened process such as:
bash python -m venv .venv .venv/bin/python -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.lock- Document the exact supported Python and dependency versions in the project metadata and README.